CVE-2026-77518: MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcptoolid in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A normal workspace user is affected if they know the active MCP tool_id of another user’s tool in the same workspace. The attacker also needs permission to create or edit a workflow they own to use the foreign tool in a workflow MCP node.
What information or access can an attacker obtain?
The tool-detail route can expose the owner’s Tool.code. That code may include MCP server configuration and headers, and the attacker can cause workflow debugging to use the owner’s MCP configuration.
Are users in different workspaces exposed to one another?
The described exposure is limited to another user’s active MCP tool within the same workspace. The provided information does not describe cross-workspace access.
What can be done if a patch is not available?
No fixed version is available as of this review. Limit normal users’ ability to create or edit workflows where possible, and treat active MCP tool IDs and Tool.code as sensitive within each workspace.
How can teams identify potential exposure?
Review whether non-owner workspace users can access tool-detail records for active MCP tool IDs and whether workflows contain MCP nodes referencing tools owned by other users. Also review Tool.code for MCP server configuration or headers that may have been exposed.